iOS iPadOS macOS CVE-2025-46308

A malicious app must be installed and executed on the affected device - this is the primary prerequisite. The flaw is rooted in authorization state management within the OS, meaning the app does not need elevated entitlements or special configuration; it needs only to be running on a vulnerable OS version (iOS/iPadOS < 18.4 or macOS Sequoia < 15.4). On iOS/iPadOS, this implicitly requires the user to have installed the app (from the App Store or via enterprise/MDM provisioning). There is no indication that a remotely accessible network service is exploitable without an app present on the device, making the AV:N designation in the provided CVSS vector suspect - defenders should treat this as a local/app-based threat. Limiting factors: the attacker must control or influence an app on the target device; remote-only network exploitation without app installation is not supported by the description.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) assigns a network attack vector, which conflicts with the description's framing of an installed app as the threat actor - an apparent mismatch worth verifying with vendor advisories. A local attack vector (AV:L) with user interaction required (UI:R) appears more consistent with the described mechanism, which would lower the effective risk rating. SSVC classifies exploitation as 'none' currently, but marks the flaw as 'Automatable: yes', indicating that if exploitation is attempted, it requires no manual attacker steps. Technical impact is 'partial', consistent with the limited confidentiality-only CVSS impact (C:L/I:N/A:N). EPSS data is not available in the provided intelligence, so statistical exploitation probability cannot be assessed. KEV status is not confirmed, and no POC is identified. Overall, this is a medium-severity issue with contained real-world risk today, but the 'Automatable' classification warrants patching on a standard schedule given the breadth of affected Apple consumer devices.

A malicious or compromised app installed on a vulnerable iPhone, iPad, or Mac exploits the authorization state management flaw to bypass the intended access controls governing sensitive user data - such as contacts, health records, or location history - and exfiltrates that data to an attacker-controlled backend. No public proof-of-concept code has been identified, but the SSVC 'Automatable: yes' designation indicates the exploitation sequence requires no interactive attacker steps once the malicious app is running. The attack is limited to information disclosure; no integrity or availability impact is expected.